How to Prevent Authentication when User Press Back button after signout in MVC Razor?

Question

I have written the code for preventing user Authentication in my GET Method like below

if (!string.IsNullOrEmpty(Session["UserName"].ToString()))
            {
                MyConnection mycon = new MyConnection();
                string str = "";
                int res = 0;
                if (Request.QueryString.ToString().Contains("ID1"))
                {
                    str = "Delete from PostTable where PostID=" + Request.QueryString["ID1"];
                    res = mycon.IODPost(str);
                }
                return View(AllPostList());
            }
            else
            {
                return RedirectToAction("Home", "Home");
            }

but when i press Back button in browser after signout, the page is postback to the previous page which can't be done.. so what should i do to prevent this?

Also don't use Session for authentication (look up session hijacking), and look at using AuthorizeAttribute or similar, or you are going to have this all over the place — RichardW1001, Jul 19 '13 at 14:37
To reiterate @SLaks there are two problems right off the bat. Please read up on [SQL Injection](http://msdn.microsoft.com/en-us/library/ms161953(v=sql.105).aspx). You shouldn't have a GET method for deleting items, that should be POST. Here's a good [explanation of the difference between the two](http://stackoverflow.com/questions/3477333/what-is-the-difference-between-post-and-get). For the postback question, where/when is this function being called? — tokyovariable, Jul 19 '13 at 14:37
Finally, security is _hard_. Don't reinvent the wheel; use existing proven solutions. — SLaks, Jul 19 '13 at 14:59

score 0 · Answer 1 · answered Jul 19 '13 at 14:43

so there are several bad practices in your example.

be aware of sql injection - use ADO.NET SqlCommand and SqlCommandParameter classes to create queries.
ASP MVC has attributes like [Authorized] , [AllowAnonymous] that can guid your app workflow for each request. You can add these at the controller lever, or method level.
Check for null againts "Session["UserName"].ToString()"

Some links :

http://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlcommand.parameters.aspx

http://msdn.microsoft.com/en-us/library/system.web.mvc.authorizeattribute(v=vs.108).aspx#using_authorizeattribute

hope this helps

How to Prevent Authentication when User Press Back button after signout in MVC Razor?

1 Answers1